ShinyHunters Resumes Exploitation of Oracle PeopleSoft via WAF Bypass Technique

Executive Summary

As of September 26, 2026, the notorious extortion gang known as ShinyHunters has been observed utilizing sophisticated URL-encoding techniques to circumvent Web Application Firewall (WAF) rules. These rules were originally implemented to mitigate the critical remote code execution (RCE) vulnerability tracked as CVE-2026-35273 within Oracle PeopleSoft suites. This development marks a significant escalation in the threat landscape, as attackers continue to weaponize previously disclosed vulnerabilities despite vendor-provided mitigations.

Threat Analysis

ShinyHunters has demonstrated a persistent interest in the PeopleSoft ecosystem. By leveraging a URL-encoding obfuscation method, the group is successfully bypassing standard signature-based detection mechanisms. This allows them to deliver malicious payloads to vulnerable, unpatched, or improperly secured PeopleSoft servers. The group's primary objective remains large-scale data exfiltration for extortion purposes, targeting organizations that have failed to fully remediate the underlying flaw.

Technical Details

The vulnerability, CVE-2026-35273, is a critical RCE flaw that allows unauthenticated attackers to execute arbitrary code on the underlying server. The recent bypass technique involves manipulating the request structure through specific URL-encoding patterns that the WAF fails to normalize before inspection. Once the WAF is bypassed, the exploit payload triggers the vulnerable component in the PeopleSoft application, granting the attacker unauthorized access to the system's backend and sensitive database contents.

Attribution Assessment

Attribution is assigned to the ShinyHunters group based on the TTPs (Tactics, Techniques, and Procedures) observed in recent data theft campaigns. The group has a documented history of targeting enterprise-grade software suites and utilizing creative bypass methods to maintain access to high-value targets. Their current focus on PeopleSoft suggests a strategic shift toward exploiting legacy enterprise infrastructure that may lack robust, updated security controls.

Implications

The ability of threat actors to bypass WAF protections significantly lowers the barrier to entry for exploiting critical vulnerabilities. Organizations relying solely on perimeter defenses like WAFs to mitigate CVE-2026-35273 are currently at high risk. The persistence of this threat underscores the necessity of applying vendor-supplied patches rather than relying on temporary network-level mitigations.

Recommendations

1. Immediate Patching: Ensure all Oracle PeopleSoft instances are updated to the latest version provided by the vendor to fully remediate CVE-2026-35273.
2. WAF Configuration Review: Audit WAF rules to ensure they are configured to handle normalized URL-encoded inputs and are not susceptible to simple obfuscation bypasses.
3. Threat Hunting: Monitor server logs for anomalous URL patterns and unauthorized outbound traffic indicative of data exfiltration.
4. Access Control: Implement strict network segmentation and restrict access to PeopleSoft management interfaces to trusted IP ranges only.